Blue Screen - after virus (&WhattheTech support)
29 min read
Also, it is posted in the Virus, Spyware & Malware Removal Forum (Sept 9, 2010).
The machine is an MicroExpress, an XP model. And no components were changed prior to the problems occuring. The machine has not been knocked over.
As explained and as per the Previous issues (see link), it all started due to a virus. No virus now. But the actions taken and suggested by WhattheTech support, I now get the Blue Screen. And Outlook shuts down by itself. I run a Chkdsk /r - as suggested by LDTate (see link).
ALl Windows update are current.
How do I check if I have a hardware problem? How do I repair Windows if that'ts the issue.
Please help!
Please first back up all your important data and if it is possible make image file of your OS, application, settings … Unfortunately you haven't made image file before virus attack.
also
give us more details about BSOD message. This tool can help - BlueScreenView to illustrate and make log file.
also
check the Event Viewer to see if there are any warnings or errors
also
Click Start, click Run, type msinfo32.exe in the Open box, and then click OK.
The information that is displayed in System Information is divided into the five categories.
Explore Hardware Resources and click on Conflicts/Sharing.
Lists the identified resource conflicts between Industry Standard Architecture (ISA) devices, and identifies resources that are shared by Peripheral Component Interconnect (PCI) devices. Use this information to help identify hardware conflicts.
Explore Components and click on Problem Devices
Lists devices with problems. Lists each device that is flagged in Device Manager, and displays the corresponding status information.
arTech
(1). FROM EVENT VIEWER - (a) APPLICATION - Some of the Error Messages - some of these same messages are repeated many times:
Event Type: Error
Event Source: nview_info
Event Category: None
Event ID: 1
Date: 9/17/2010
Time: 15:59:00
User: N/A
Computer: MASOUD-58B8EA
Description:
The description for Event ID ( 1 ) in Source ( nview_info ) cannot be found. The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer. You may be able to use the /AUXSOURCE= flag to retrieve this description; see Help and Support for details. The following information is part of the event: NVIEW : StatusClient: shared heap exhausted or damaged
.
Event Type: Error
Event Source: Application Hang
Event Category: (101)
Event ID: 1002
Date: 9/17/2010
Time: 11:41:36
User: N/A
Computer: MASOUD-58B8EA
Description:
Hanging application OUTLOOK.EXE, version 12.0.6539.5000, hang module hungapp, version 0.0.0.0, hang address 0x00000000.
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 48 61 6e 67 ion Hang
0010: 20 20 4f 55 54 4c 4f 4f OUTLOO
0018: 4b 2e 45 58 45 20 31 32 K.EXE 12
0020: 2e 30 2e 36 35 33 39 2e .0.6539.
0028: 35 30 30 30 20 69 6e 20 5000 in
0030: 68 75 6e 67 61 70 70 20 hungapp
0038: 30 2e 30 2e 30 2e 30 20 0.0.0.0
0040: 61 74 20 6f 66 66 73 65 at offse
0048: 74 20 30 30 30 30 30 30 t 000000
0050: 30 30 00
—-
Event Type: Error
Event Source: nview_info
Event Category: None
Event ID: 1
Date: 9/15/2010
Time: 22:58:34
User: N/A
Computer: MASOUD-58B8EA
Description:
The description for Event ID ( 1 ) in Source ( nview_info ) cannot be found. The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer. You may be able to use the /AUXSOURCE= flag to retrieve this description; see Help and Support for details. The following information is part of the event: NVIEW : StatusClient: shared heap exhausted or damaged
.
(2) . FROM EVENT VIEWER - (a) MICROSFT OFFICE SESSION - some messages repeating :
Event Type: Error
Event Source: Microsoft Office 12 Sessions
Event Category: None
Event ID: 7001
Date: 9/16/2010
Time: 17:41:30
User: N/A
Computer: MASOUD-58B8EA
Description:
ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6539.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 4330 seconds with 2220 seconds of active time. This session ended with a crash.
————–
Event Type: Error
Event Source: Microsoft Office 12 Sessions
Event Category: None
Event ID: 7001
Date: 9/1/2010
Time: 23:22:03
User: N/A
Computer: MASOUD-58B8EA
Description:
ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6535.5005, Microsoft Office Version: 12.0.6425.1000. This session lasted 53 seconds with 0 seconds of active time. This session ended with a crash.
————
Event Type: Warning
Event Source: Microsoft Office 12 Sessions
Event Category: None
Event ID: 7003
Date: 10/22/2008
Time: 20:10:21
User: N/A
Computer: MASOUD-58B8EA
Description:
ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session was terminated unexpectedly.
(3) . FROM EVENT VIEWER - (a) SYSTEM- some messages repeating :
Event Type: Error
Event Source: Dhcp
Event Category: None
Event ID: 1000
Date: 9/18/2010
Time: 13:50:24
User: N/A
Computer: MASOUD-58B8EA
Description:
Your computer has lost the lease to its IP address 192.168.0.11 on the Network Card with network address 001217671BF2.
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
———-
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 9/18/2010
Time: 09:40:55
User: N/A
Computer: MASOUD-58B8EA
Description:
The HID Input Service service terminated with the following error:
The specified module could not be found.
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
————–
Event Type: Error
Event Source: Dhcp
Event Category: None
Event ID: 1001
Date: 9/17/2010
Time: 17:42:20
User: N/A
Computer: MASOUD-58B8EA
Description:
Your computer was not assigned an address from the network (by the DHCP Server) for the Network Card with network address 001217671BF2. The following error occurred:
The operation was canceled by the user. . Your computer will continue to try and obtain an address on its own from the network address (DHCP) server.
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: c7 04 00 00 Ç…
———
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7001
Date: 9/12/2010
Time: 00:41:02
User: N/A
Computer: MASOUD-58B8EA
Description:
The TCP/IP NetBIOS Helper service depends on the AFD service which failed to start because of the following error:
A device attached to the system is not functioning.
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
(1) Hardware Resources - Conflicts/Sharing
I/O Port 0x00000000-0x00000CF7 PCI bus
I/O Port 0x00000000-0x00000CF7 Direct memory access controller
I/O Port 0x000003C0-0x000003DF Intel® G33/G31/P35/P31 Express Chipset PCI Express Root Port - 29C1
I/O Port 0x000003C0-0x000003DF NVIDIA GeForce 7300 SE/7200 GS
Memory Address 0xF4000000-0xF6FFFFFF Intel® G33/G31/P35/P31 Express Chipset PCI Express Root Port - 29C1
Memory Address 0xF4000000-0xF6FFFFFF NVIDIA GeForce 7300 SE/7200 GS
IRQ 23 Intel® ICH9 Family USB Universal Host Controller - 2934
IRQ 23 Intel® ICH9 Family USB2 Enhanced Host Controller - 293A
IRQ 16 Intel® G33/G31/P35/P31 Express Chipset PCI Express Root Port - 29C1
IRQ 16 NVIDIA GeForce 7300 SE/7200 GS
IRQ 16 Intel® ICH9 Family USB Universal Host Controller - 2937
IRQ 16 Intel® ICH9 Family PCI Express Root Port 1 - 2940
IRQ 16 Intel® ICH9 Family PCI Express Root Port 5 - 2948
IRQ 16 Realtek RTL8168/8111 PCI-E Gigabit Ethernet NIC
Memory Address 0xE0000000-0xEFFFFFFF Intel® G33/G31/P35/P31 Express Chipset PCI Express Root Port - 29C1
Memory Address 0xE0000000-0xEFFFFFFF NVIDIA GeForce 7300 SE/7200 GS
IRQ 18 Intel® ICH9 Family USB Universal Host Controller - 2939
IRQ 18 Intel® ICH9 Family USB2 Enhanced Host Controller - 293C
IRQ 18 Intel® ICH9 Family USB Universal Host Controller - 2936
IRQ 19 Intel® ICH9 Family PCI Express Root Port 4 - 2946
IRQ 19 Standard Dual Channel PCI IDE Controller
IRQ 19 Intel® ICH9 Family USB Universal Host Controller - 2935
IRQ 19 Intel® ICH9 Family 2 port Serial ATA Storage Controller 2 - 2926
Memory Address 0xA0000-0xBFFFF PCI bus
Memory Address 0xA0000-0xBFFFF Intel® G33/G31/P35/P31 Express Chipset PCI Express Root Port - 29C1
Memory Address 0xA0000-0xBFFFF NVIDIA GeForce 7300 SE/7200 GS
I/O Port 0x000003B0-0x000003BB Intel® G33/G31/P35/P31 Express Chipset PCI Express Root Port - 29C1
I/O Port 0x000003B0-0x000003BB NVIDIA GeForce 7300 SE/7200 GS
I/O Port 0x00000290-0x0000029F Motherboard resources
I/O Port 0x00000290-0x0000029F Motherboard resources
I/O Port 0x0000C000-0x0000CFFF Intel® ICH9 Family PCI Express Root Port 4 - 2946
I/O Port 0x0000C000-0x0000CFFF Standard Dual Channel PCI IDE Controller
I/O Port 0x0000D000-0x0000DFFF Intel® ICH9 Family PCI Express Root Port 5 - 2948
I/O Port 0x0000D000-0x0000DFFF Realtek RTL8168/8111 PCI-E Gigabit Ethernet NIC
=================
(2) Components - Problem Devices
Audio Codecs ROOT\MEDIA\MS_MMACM 39
C4500,192.168.0.13 ROOT\IMAGE\0000 This device is disabled.
Legacy Audio Drivers ROOT\MEDIA\MS_MMDRV 39
Legacy Video Capture Devices ROOT\MEDIA\MS_MMVCD 39
Media Control Devices ROOT\MEDIA\MS_MMMCI 39
Photosmart C4500 series ROOT\MULTIFUNCTION\0000 This device is disabled.
Video Codecs ROOT\MEDIA\MS_MMVID 39
First questions.
1. Do you have antivirus program integrated in Outlook as “spamkiller”?
2. Do you use some multimedia external device(s)?
3. These are recently events and one from Date: 10/22/2008?
Please answer and note the information about BlueScreen.
Meantime
1. run sfc /scannow command as LDTate said. Know you haven't Windows Cd. See Topic Slow Windows response time by Rappy and instruction by rshaffer61 in Post#10.
2. start Outlook in safe mode - Run type outlook.exe /safe. This loads Outlook without many of the customization files and add-ins loaded.
3. for most issues that involve Internet connectivity, start by using the Network Diagnostics tool to identify the source of the issue. To use Network Diagnostics, follow these steps:
- Click Start, and then click Help and Support.
- Click the link to Use Tools to view your computer information and diagnose problems, and then click Network Diagnostics in the list on the left.
- Click Set scanning options. Domain Name System (DNS), Dynamic Host Configuration Protocol (DHCP), Default Gateways, and Internet Protocol Address must be checked. Others might be checked.
- When you click Scan your system, Network Diagnostics gathers configuration information and performs automated troubleshooting of the network connection.
- When the process is completed, look for any items that are marked "FAILED" in red, expand those categories, and then view the additional details about what the testing showed.
4. remove unused drivers and devices. Device Manager displays only non-Plug and Play devices, drivers, and printers when you click Show hidden devices on the View menu. Devices that you install that are not connected to the computer (such as a Universal Serial Bus [USB] device or "ghosted" devices) are not displayed in Device Manager, even when you click Show hidden devices. Use instruction from Microsoft Device Manager does not display devices that are not connected to the Windows XP-based computer. Now that you have created this entry, when you open Device Manager, you can click on View and then select Show hidden devices from the menu. You can identify the hidden devices by their grayed-out icons and uninstall all unused drivers and devices.
arTech
You have 3 real-time anti spyware protection programs - to mach. Avast Pro is antivirus and anti-spyware engine. Enough.
Please Remove Resident Spybot, because can interfere with other software and with Avast and with Ad Aware. After that you can use Spybot Search & Destroy on demand.
Ad Aware - will see latter.
2. TV Tuner is a kind of external multimedia device, with USB connection. If you dont't use tuner any more, uninstall drivers or appropriate software?
arTech
It is late now and we continue tomorrow.
Do you have problem in Safe mode without network?
Are there any red or yellow flags in Device Manager?
arTech
Do you can to watch movie on your PC? Do you use HP Photosmart C4500 printer, and TV tuner? You have installed unused and failed drivers. They can interfere with other drivers.
This is a point when we have to clean PC and uninstall drivers and programs.
Again - make image file of your system files! See Topic Thinking about backup?, now is the time by Ztruker. Use free Macrium Reflect. If we accidentally delete something wrong we will can restore that all.
Device manager
Right click and try to update all drivers with yellow mark.
Uninstall Photosmart C4500 driver as Problem Device.
Remove unused drivers and devices. Item 4, my Post #7.
to be continued
arTech
Ask AI
AI can make mistakes. Check the cited posts. Archived advice can be out-of-date
Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI